Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://www.mediafir...

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://www.mediafire.com/file/zgpxe8tj10498ea/RRNAMEUNLOCKER.rar/file

  • Sample

    240222-qjav6shh6v

Score
10/10
44caliberxwormpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

Attributes
  • Install_directory

    %AppData%

  • install_file

    XClient.exe

  • pastebin_url

    https://pastebin.com/raw/1XHTzgw2

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1209149722129072188/ECi3Fxole6_vJLoePzHdH-8weEA_LteXKkAdEYVAk5QqlvTk3RhiGIcSonw5okumm0nk

Targets

    • Target

      https://www.mediafire.com/file/zgpxe8tj10498ea/RRNAMEUNLOCKER.rar/file

    Score
    10/10
    44caliberxwormpersistenceratspywarestealertrojan

    • 44Caliber

      An open source infostealer written in C#.

      stealer44caliber

    • Detect Xworm Payload

    • Xworm

      Xworm is a remote access trojan written in C#.

      trojanratxworm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks